A trusted computer system has a defined and verifiable function, shrouds the memory used by the system from inspection, has access to a private key that uniquely identifies the system, cannot be inspected from outside the system or any software running inside the system, and runs secure firmware that cannot be inspected or modified either from outside the trusted computer system or from software running in the trusted computer system. On a trusted computer system, the secure firmware has access to the private key of the trusted computer system.
A confidential image can be deployed to the trusted computer system. With the confidential image deployed to the trusted computer system, any party who inspects storage outside the trusted system cannot learn the contents of the confidential image, any party who inspects communication channels used for deploying the confidential image to the trusted computer system cannot learn the contents of the image.
A standalone dump mechanism can dump an operating system image, anytime and regardless of the state of the operating system, to a dump medium, provided the system is capable of booting an image. A confidential standalone dump image must ensure that the contents of dumped image can only be observed by the owner of the dumped image.